CWE-943 · 112 kayıt
Improper Neutralization of Special Elements in Data Query Logic
Bu sınıftaki CVE’ler
112 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2026-40351İstismar yok | FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypassfastgpt · fastgpt · CWE-943 | Kritik9,8 | — | %0,6 | 17 Nis 2026 |
39İzleyin | CVE-2026-8649İstismar yok | Institution scope bypass vulnerability in custom reportsprogress · moveit transfer · CWE-943 | Kritik9,8 | — | %0,5 | 8 Tem 2026 |
37İzleyin | CVE-2017-12904İstismar yok | Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remonewsbeuter · newsbeuter · CWE-943 | Yüksek8,8 | — | %6,4 | 23 Ağu 2017 |
37İzleyin | CVE-2026-32248İstismar yok | Parse Server: Account takeover via operator injection in authentication data identifierparseplatform · parse-server · CWE-943 | Kritik9,3 | — | %1,0 | 12 Mar 2026 |
37İzleyin | CVE-2026-41274İstismar yok | Flowise: Cypher Injection in GraphCypherQAChainflowiseai · flowise · CWE-943 | Kritik9,3 | — | %0,7 | 23 Nis 2026 |
37İzleyin | CVE-2026-29793İstismar yok | NoSQL Injection via WebSocket id Parameter in MongoDB Adapterfeathersjs · feathers · CWE-943 | Kritik9,3 | — | %0,6 | 10 Mar 2026 |
36İzleyin | CVE-2018-7829İstismar yok | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen.schneider-electric · d6220 firmware · CWE-943 | Yüksek8,8 | — | %1,7 | 22 May 2019 |
36İzleyin | CVE-2026-45689İstismar yok | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATOrocketchat · rocket.chat · CWE-943 | Kritik9,1 | — | %0,5 | 24 Haz 2026 |
36İzleyin | CVE-2026-45688İstismar yok | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijackrocketchat · rocket.chat · CWE-943 | Kritik9,1 | — | %0,5 | 24 Haz 2026 |
36İzleyin | CVE-2026-41328İstismar yok | Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Fielddgraph · dgraph · CWE-943 | Kritik9,1 | — | %0,5 | 24 Nis 2026 |
36İzleyin | CVE-2026-41327İstismar yok | Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Fielddgraph · dgraph · CWE-943 | Kritik9,1 | — | %0,5 | 24 Nis 2026 |
36İzleyin | CVE-2026-20284İstismar yok | Cisco Identity Search Engine SXP REST API SQL Injection Vulnerabilitycisco · cisco identity services engine software · CWE-943 | Kritik9,1 | — | %0,4 | 16 Eyl 2026 |
35İzleyin | CVE-2026-40352İstismar yok | FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeoverfastgpt · fastgpt · CWE-943 | Yüksek8,8 | — | %0,5 | 17 Nis 2026 |
35İzleyin | CVE-2026-76316İstismar yok | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprisesplunk · splunk · CWE-943 | Yüksek8,8 | — | %0,5 | 19 Ağu 2026 |
35İzleyin | CVE-2024-4872İstismar yok | A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.hitachienergy · microscada pro sys600 · CWE-943 | Yüksek8,8 | — | %0,5 | 27 Ağu 2024 |
35İzleyin | CVE-2026-76254İstismar yok | SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprisesplunk · splunk · CWE-943 | Yüksek8,8 | — | %0,4 | 19 Ağu 2026 |
34İzleyin | CVE-2026-40141İstismar yok | High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Accessbeyondtrust · privileged remote access · CWE-943 | Yüksek8,5 | — | %0,5 | 6 Tem 2026 |
34İzleyin | CVE-2026-81525İstismar yok | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Drivermongodb · php driver · CWE-943 | Yüksek8,6 | — | %0,5 | 27 Ağu 2026 |
34İzleyin | CVE-2026-30941İstismar yok | Parse Server has a NoSQL injection via token type in password reset and email verification endpointsparseplatform · parse-server · CWE-943 | Yüksek8,7 | — | %0,5 | 10 Mar 2026 |
34İzleyin | CVE-2026-91937İstismar yok | Flowise before 3.1.4 NoSQL Injection via sessionIdflowiseai · flowise · CWE-943 | Yüksek8,7 | — | %0,5 | 15 Eyl 2026 |
34İzleyin | CVE-2026-63637İstismar yok | Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriterdgraph-io · dgraph · CWE-943 | Yüksek8,6 | — | %0,4 | 6 Ağu 2026 |
34İzleyin | CVE-2026-73618İstismar yok | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameterbudibase · server · CWE-943 | Yüksek8,7 | — | %0,4 | 13 Ağu 2026 |
34İzleyin | CVE-2026-100631İstismar yok | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injectionparse-community · parse-server · CWE-943 | Yüksek8,7 | — | %0,4 | 26 Eyl 2026 |
33İzleyin | CVE-2026-93760İstismar yok | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardmongodb · mongoid · CWE-943 | Yüksek8,3 | — | %0,5 | 18 Eyl 2026 |
33İzleyin | CVE-2026-88022İstismar yok | Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravelmongodb · laravel mongodb · CWE-943 | Yüksek8,4 | — | %0,4 | 10 Eyl 2026 |
- CVE-2026-4035139İzleyin
FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
KritikCVSS 9,8İstismar yokEPSS %1fastgpt · fastgpt17 Nis 2026
- CVE-2026-864939İzleyin
Institution scope bypass vulnerability in custom reports
KritikCVSS 9,8İstismar yokEPSS %0progress · moveit transfer8 Tem 2026
- CVE-2017-1290437İzleyin
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remo
YüksekCVSS 8,8İstismar yokEPSS %6newsbeuter · newsbeuter23 Ağu 2017
- CVE-2026-3224837İzleyin
Parse Server: Account takeover via operator injection in authentication data identifier
KritikCVSS 9,3İstismar yokEPSS %1parseplatform · parse-server12 Mar 2026
- CVE-2026-4127437İzleyin
Flowise: Cypher Injection in GraphCypherQAChain
KritikCVSS 9,3İstismar yokEPSS %1flowiseai · flowise23 Nis 2026
- CVE-2026-2979337İzleyin
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
KritikCVSS 9,3İstismar yokEPSS %1feathersjs · feathers10 Mar 2026
- CVE-2018-782936İzleyin
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen.
YüksekCVSS 8,8İstismar yokEPSS %2schneider-electric · d6220 firmware22 May 2019
- CVE-2026-4568936İzleyin
Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO
KritikCVSS 9,1İstismar yokEPSS %1rocketchat · rocket.chat24 Haz 2026
- CVE-2026-4568836İzleyin
Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack
KritikCVSS 9,1İstismar yokEPSS %0rocketchat · rocket.chat24 Haz 2026
- CVE-2026-4132836İzleyin
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
KritikCVSS 9,1İstismar yokEPSS %0dgraph · dgraph24 Nis 2026
- CVE-2026-4132736İzleyin
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
KritikCVSS 9,1İstismar yokEPSS %0dgraph · dgraph24 Nis 2026
- CVE-2026-2028436İzleyin
Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability
KritikCVSS 9,1İstismar yokEPSS %0cisco · cisco identity services engine software16 Eyl 2026
- CVE-2026-4035235İzleyin
FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
YüksekCVSS 8,8İstismar yokEPSS %1fastgpt · fastgpt17 Nis 2026
- CVE-2026-7631635İzleyin
Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise
YüksekCVSS 8,8İstismar yokEPSS %1splunk · splunk19 Ağu 2026
- CVE-2024-487235İzleyin
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.
YüksekCVSS 8,8İstismar yokEPSS %0hitachienergy · microscada pro sys60027 Ağu 2024
- CVE-2026-7625435İzleyin
SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise
YüksekCVSS 8,8İstismar yokEPSS %0splunk · splunk19 Ağu 2026
- CVE-2026-4014134İzleyin
High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access
YüksekCVSS 8,5İstismar yokEPSS %1beyondtrust · privileged remote access6 Tem 2026
- CVE-2026-8152534İzleyin
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
YüksekCVSS 8,6İstismar yokEPSS %0mongodb · php driver27 Ağu 2026
- CVE-2026-3094134İzleyin
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
YüksekCVSS 8,7İstismar yokEPSS %0parseplatform · parse-server10 Mar 2026
- CVE-2026-9193734İzleyin
Flowise before 3.1.4 NoSQL Injection via sessionId
YüksekCVSS 8,7İstismar yokEPSS %0flowiseai · flowise15 Eyl 2026
- CVE-2026-6363734İzleyin
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
YüksekCVSS 8,6İstismar yokEPSS %0dgraph-io · dgraph6 Ağu 2026
- CVE-2026-7361834İzleyin
Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
YüksekCVSS 8,7İstismar yokEPSS %0budibase · server13 Ağu 2026
- CVE-2026-10063134İzleyin
Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection
YüksekCVSS 8,7İstismar yokEPSS %0parse-community · parse-server26 Eyl 2026
- CVE-2026-9376033İzleyin
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
YüksekCVSS 8,3İstismar yokEPSS %1mongodb · mongoid18 Eyl 2026
- CVE-2026-8802233İzleyin
Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel
YüksekCVSS 8,4İstismar yokEPSS %0mongodb · laravel mongodb10 Eyl 2026